Buggy code:
@ Controller public class DocumentController extends AbstractBaseController { @ Autowired private DocumentInfoService documentInfoService ; @ Autowired private BaseService baseService ; @ RequestMapping ( "//openDocument" ) @ ResponseBody public ResponseEntity < byte [ ] > openDocument ( final HttpServletRequest request , final HttpServletResponse response ) { } <START_BUG> @ RequestMapping ( { "//showDocument" , "//userdata//showDocument" } ) <END_BUG> @ ResponseBody public ResponseEntity < byte [ ] > showDocument ( final HttpServletRequest request , final HttpServletResponse response ) { byte [ ] documentContent = null ; DocumentInfo documentInfo = null ; HttpHeaders headers = new HttpHeaders ( ) ; try { String documentId = request . getParameter ( DOCUMENT_ID ) ; String category = request . getParameter ( "category" ) ; boolean skipFlag = ( ( ( request . getParameter ( "skipFlag" ) ) != null ) && ( ( request . getParameter ( "skipFlag" ) . equals ( "true" ) ) || ( request . getParameter ( "skipFlag" ) . equals ( true ) ) ) ) ? true : false ; boolean docInSession = false ; if ( ( ( ! ( GDEStringUtils . isNullOrEmpty ( category ) ) ) && ( null != ( GDESessionFacade . getDocumentMapInCaseOfError ( request ) ) ) ) && ( ! skipFlag ) ) { for ( DocumentDto documentDto : GDESessionFacade . getDocumentMapInCaseOfError ( request ) . values ( ) ) { if ( documentDto . getDocCategory ( ) . name ( ) . equals ( category ) ) { docInSession = true ; documentContent = null ; headers = new HttpHeaders ( ) ; documentContent = documentDto . getBytes ( ) ; ResourceContentType resourceContentType = baseService . getResourceContentType ( documentDto . getFileName ( ) ) ; if ( resourceContentType == ( ResourceContentType . CONTENT_TYPE_MP4 ) ) { try { String headerValue = String . format ( "attachment;<seq2seq4repair_space>filename=\"%s\"" , documentDto . getFileName ( ) ) ; String headerKey = "Content-Disposition" ; response . setHeader ( headerKey , headerValue ) ; OutputStream outStream = response . getOutputStream ( ) ; outStream . write ( documentContent ) ; outStream . close ( ) ; } catch ( IOException e ) { throw new GDEException ( e ) ; } return null ; } String contentType = resourceContentType . getContentType ( ) ; headers . setContentType ( MediaType . parseMediaType ( contentType ) ) ; headers . add ( "content-disposition" , String . format ( "inline;<seq2seq4repair_space>filename=\"%s\"" , documentDto . getFileName ( ) ) ) ; headers . setCacheControl ( "must-revalidate,<seq2seq4repair_space>post-check=0,<seq2seq4repair_space>pre-check=0" ) ; headers . setContentLength ( documentContent . length ) ; } } } if ( ! docInSession ) { if ( ( ( documentId != null ) && ( ! ( GDEStringUtils . isNullOrEmpty ( documentId ) ) ) ) && ( ( Long . valueOf ( documentId ) ) != 0L ) ) { documentInfo = documentInfoService . getDocumentInfoById ( Long . valueOf ( documentId ) ) ; } else if ( ( ( category . equals ( INTERNATUR . name ( ) ) ) || ( category . equals ( ORDINATUR . name ( ) ) ) ) || ( category . equals ( DIPLOMA . name ( ) ) ) ) { Collection < DocumentInfo > docList = documentInfoService . getListofDocumentInfo ( getApplicationUser ( request ) ) ; for ( DocumentInfo doc : docList ) { if ( ( ( ( category . equals ( DIPLOMA . name ( ) ) ) && ( doc . getCategoryName ( ) . name ( ) . equals ( DEFAULT_MEDICAL_DIPLOMA . name ( ) ) ) ) || ( ( category . equals ( INTERNATUR . name ( ) ) ) && ( doc . getCategoryName ( ) . name ( ) . equals ( DEFAULT_INTERNATUR . name ( ) ) ) ) ) || ( ( category . equals ( ORDINATUR . name ( ) ) ) && ( doc . getCategoryName ( ) . name ( ) . equals ( DEFAULT_INTERNATUR . name ( ) ) ) ) ) { documentInfo = doc ; break ; } } } String fullPath = ( GDEBaseConstants . TOMCAT_ROOT_PATH ) + ( documentInfo . getFilePath ( ) ) ; Path path = Paths . get ( fullPath ) ; documentContent = Files . readAllBytes ( path ) ; ResourceContentType resourceContentType = baseService . getResourceContentType ( documentInfo . getFileName ( ) ) ; if ( resourceContentType == ( ResourceContentType . CONTENT_TYPE_MP4 ) ) { try { GDEFileUtil . downloadAFile ( response , documentInfo ) ; } catch ( IOException e ) { throw new GDEException ( e ) ; } return null ; } String contentType = resourceContentType . getContentType ( ) ; headers . setContentType ( MediaType . parseMediaType ( contentType ) ) ; headers . add ( "content-disposition" , String . format ( "inline;<seq2seq4repair_space>filename=\"%s\"" , documentInfo . getFileName ( ) ) ) ; headers . setCacheControl ( "must-revalidate,<seq2seq4repair_space>post-check=0,<seq2seq4repair_space>pre-check=0" ) ; headers . setContentLength ( documentContent . length ) ; } } catch ( IOException e ) { throw new GDEException ( e ) ; } ResponseEntity < byte [ ] > responseEntity = new ResponseEntity < byte [ ] > ( documentContent , headers , HttpStatus . OK ) ; return responseEntity ; } }

Fix:
@ RequestMapping ( { "//showDocument" , "//userdata//showDocument" , "//internal//showDocument" , "//internal//userdata//showDocument" } )